WEBSITE ANALYSIS REPORT

http://modsbase.com/qwd0oxpm0uey/2197863850_BOB__the_Tree_and_Prop_Replacer_1.0.1.zip.html

17 Dec 2025 · 09:02:10.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

cdn.show-sb.com1 captured requests
cdn.storageimagedisplay.com5 captured requests
cmp.setupcmp.com7 captured requests
cnt.trvdp.com1 captured requests
code.jquery.com1 captured requests
coucalhidated.com1 captured requests
creative-sb1.com5 captured requests
finishedwindscreen.com1 captured requests
flushpersist.com2 captured requests
fonts.googleapis.com2 captured requests
fonts.gstatic.com4 captured requests
granddaughterapexeuropean.com10 captured requests
kettledroopingcontinuation.com4 captured requests
modsbase.com32 captured requests
preferencenail.com2 captured requests
protrafficinspector.com1 captured requests
stg.truvidplayer.com1 captured requests
wayfarerorthodox.com1 captured requests
weirdopt.com1 captured requests
www.googletagmanager.com1 captured requests

Connections

modsbase.com → cdn.show-sb.comCalls1 captured connections
modsbase.com → cdn.storageimagedisplay.comLoads from5 captured connections
modsbase.com → cmp.setupcmp.comCalls4 captured connections
modsbase.com → cmp.setupcmp.comLoads from3 captured connections
modsbase.com → cnt.trvdp.comLoads from1 captured connections
modsbase.com → code.jquery.comLoads from1 captured connections
modsbase.com → coucalhidated.comLoads from1 captured connections
modsbase.com → creative-sb1.comCalls3 captured connections
modsbase.com → creative-sb1.comLoads from2 captured connections
modsbase.com → finishedwindscreen.comLoads from1 captured connections
modsbase.com → flushpersist.comLoads from2 captured connections
modsbase.com → fonts.googleapis.comLoads from2 captured connections
modsbase.com → fonts.gstatic.comLoads from4 captured connections
modsbase.com → granddaughterapexeuropean.comCalls2 captured connections
modsbase.com → granddaughterapexeuropean.comLoads from8 captured connections
modsbase.com → kettledroopingcontinuation.comLoads from4 captured connections
modsbase.com → preferencenail.comLoads from2 captured connections
modsbase.com → protrafficinspector.comCalls1 captured connections
modsbase.com → stg.truvidplayer.comCalls1 captured connections
modsbase.com → wayfarerorthodox.comLoads from1 captured connections
modsbase.com → weirdopt.comLoads from1 captured connections
modsbase.com → www.googletagmanager.comLoads from1 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

09:01:47.696 GET 200 document 34.0 KB 354 ms 1 alerts

09:01:48.249 GET 200 stylesheet 4.4 KB 619 ms —

09:01:48.251 GET 200 stylesheet 347.4 KB 9 ms 1 alerts

09:01:48.252 GET 200 stylesheet 23.6 KB 10 ms 1 alerts

09:01:48.254 GET 200 stylesheet 16.6 KB 9 ms 1 alerts

09:01:48.256 GET 200 script 84.6 KB 154 ms —

09:01:48.257 GET 200 script 78.8 KB 10 ms 1 alerts

09:01:48.258 GET 200 script 3.3 KB 10 ms 1 alerts

09:01:48.264 GET 200 script 18.9 KB 10 ms 1 alerts

09:01:48.265 GET 200 script 3.0 KB 10 ms 1 alerts

09:01:48.266 GET 200 script 1.9 KB 10 ms 1 alerts

09:01:48.268 GET 200 script 2.8 KB 10 ms 1 alerts

09:01:48.269 GET 200 script 2.1 KB 7 ms 1 alerts

09:01:48.272 GET 200 script 379.5 KB 668 ms —

09:01:48.274 GET 200 script 1.0 KB 107 ms —

09:01:48.275 GET 200 script 116.2 KB 99 ms —

09:01:48.277 GET 200 img 11.9 KB 10 ms 1 alerts

09:01:48.278 GET 200 img 474 B 10 ms 1 alerts

09:01:48.280 GET 200 img 402 B 5 ms 1 alerts

09:01:48.282 GET 200 img 468 B 8 ms 1 alerts

09:01:48.284 GET 200 img 7.0 KB 8 ms 1 alerts

09:01:48.288 GET 200 img 704 B 7 ms 1 alerts

09:01:48.290 GET 200 img 252 B 7 ms 1 alerts

09:01:48.292 GET 200 img 774 B 7 ms 1 alerts

09:01:48.297 GET 200 img 50.4 KB 6 ms 1 alerts

09:01:48.299 GET 200 img 782 B 6 ms 1 alerts

09:01:48.302 GET 200 img 465 B 5 ms 1 alerts

09:01:48.309 GET 200 img 255 B 7 ms 1 alerts

09:01:48.313 GET 200 img 465 B 5 ms 1 alerts

09:01:48.314 GET 200 img 782 B 7 ms 1 alerts

09:01:48.315 GET 200 script 354 B 6 ms 1 alerts

09:01:48.316 GET 200 script 623 B 6 ms 1 alerts

09:01:48.334 GET 200 script 6 B 134 ms 2 alerts

09:01:48.336 GET 200 script 6.0 KB 88 ms —

09:01:48.337 GET 200 script 42.8 KB 514 ms 2 alerts

09:01:48.668 GET 200 font 48.4 KB 254 ms —

09:01:48.706 GET 200 xhr 13 B 692 ms —

09:01:48.730 GET 302 script 10.2 KB 15 ms 1 alerts

09:01:48.741 GET 200 fetch 226 B 37 ms —

09:01:48.775 GET 200 script 10.2 KB 8 ms 1 alerts

09:01:48.825 GET 200 xhr 40 B 289 ms —

09:01:48.826 GET 200 xhr 11.3 KB 759 ms 1 alerts

09:01:48.827 GET 200 script 109.0 KB 831 ms 1 alerts

Transaction #56

Request / response

URL

GET HTTPS

https://granddaughterapexeuropean.com/ab/38/b4/ab38b4a672db4f20dc94cb5033482521.js

IP / ASN

172.240.253.132

AS7979 · SERVERS-COM

Requested by: https://modsbase.com/qwd0oxpm0uey/2197863850_BOB__the_Tree_and_Prop_Replacer_1.0.1.zip.html

Resource information

File type: JavaScript source, ASCII text, with very long lines (65536), with no line terminators
MIME type: application/javascript
First seen (UTC): 17 Dec 2025 · 09:02:23.083 UTC
Last seen (UTC): 17 Dec 2025 · 09:02:23.083 UTC
Times seen: 1

Size: 109.0 KB (111634 bytes)
MD5: e35dec47a0f8e476679ebe70bb5b255b
SHA1: cbafe696af3d3923e573b751a3ccb694f25ddc6a
SHA256: 4e718ff6104b0ca448fbfde7a1e897fbebf4d2e1bbae067b48d3ff8c6afde83f

Certificate information

Issuer: Let's Encrypt · R12
Subject: granddaughterapexeuropean.com
Protocol / cipher: TLSv1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: 1F:46:5E:E1:8B:70:9C:1C:14:D5:58:95:AB:5F:96:42:87:F8:C3:1E
Valid from: Tue, 02 Dec 2025 08:10:40 GMT
Valid until: Mon, 02 Mar 2026 08:10:39 GMT

Technology fingerprints

HSTS (Security)
Envoy (Reverse proxies)
Nginx:1.21.6 (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Quad9 DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /ab/38/b4/ab38b4a672db4f20dc94cb5033482521.js HTTP/1.1
Host: granddaughterapexeuropean.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://modsbase.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Wed, 17 Dec 2025 09:01:49 GMT
Content-Type: application/javascript
Content-Length: 40072
Connection: keep-alive
content-encoding: gzip
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
accept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
x-envoy-upstream-service-time: 5
Host: granddaughterapexeuropean.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
X-Request-ID: 01e3256c31daa8374f8de3325b337adf
Cache-Control: no-cache, max-age=0, private, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

09:01:48.828 GET 200 script 77.1 KB 820 ms 1 alerts

09:01:48.949 POST 200 xhr 0 B 8 ms 1 alerts

09:01:49.130 GET 200 fetch 5.5 KB 7 ms —

09:01:49.198 GET 200 xhr 749.0 KB 6 ms —

09:01:49.386 GET 200 fetch 151.5 KB 5 ms —

09:01:49.388 GET 200 img 0 B 97 ms 1 alerts

09:01:49.390 GET 200 img 0 B 96 ms 1 alerts

http://modsbase.com/qwd0oxpm0uey/2197863850_BOB__the_Tree_and_Prop_Replacer_1.0.1.zip.html

Domain graph

Hostnames

Connections

Network requests

Transaction #56

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://modsbase.com/qwd0oxpm0uey/2197863850_BOB__the_Tree_and_Prop_Replacer_1.0.1.zip.html

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #56

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://modsbase.com/qwd0oxpm0uey/2197863850_BOB__the_Tree_and_Prop_Replacer_1.0.1.zip.html

Domain graph

Network requests